Explicit enumeration of highly sensitive data collection (SSNs, financial and credit card details) provides less protection than the previous version's categorization approach and suggests routine collection practices.

New explicit permission for behavioral advertising use and cross-context data sharing represents a direct expansion of commercial data use practices not clearly articulated in the previous version.

This new carve-out significantly limits consumer privacy rights for the core business function of credit reporting, allowing Equifax to exempt substantial data handling from state privacy law compliance.

Expansion beyond California-only CCPA/CPRA rights to cover multiple state privacy laws (Virginia, Colorado, Connecticut, Texas) reflects evolving U.S. privacy landscape and provides broader coverage of consumer rights.

New provision explicitly acknowledges GDPR/UK GDPR rights, indicating Equifax's international data processing scope and compliance obligations that were not previously stated in the policy.

New explicit provision authorizing law enforcement and government disclosures broadens data sharing scenarios beyond commercial purposes and could enable expansive interpretation of governmental requests.

New detailed disclosure of tracking technologies indicates expanded online behavioral monitoring across websites and mobile apps for analytics and advertising purposes not previously articulated.

Removal of explicit biometric data collection disclosure eliminates transparency around sensitive identity verification practices and may obscure such collection under broader categories.

Removal of detailed profiling and inference disclosure eliminates transparency about algorithmic use of personal data to build psychological and behavioral profiles, a practice particularly concerning for credit decisions.

Removal of specific geolocation collection disclosure obscures location data practices, though similar data collection may now be covered under generic 'tracking technologies' language.

Removal of California-specific detailed rights list, though replaced with vaguer multi-state provision, represents less explicit articulation of specific CCPA/CPRA consumer protections.

Removal of detailed sensitive information categorization eliminates transparency around special handling of highly protected data categories and appears to shift to less protective handling under general data practices.

Removal of COPPA-related provisions eliminates transparency about children's data protection and reduces clarity about how inadvertent minor data collection is handled.

Current version expands scope to explicitly include subsidiaries, service providers, and marketing partners for their own purposes, with weaker language changing 'opt out' to 'subject to your choices.'

Previous version's qualifier 'unless a longer retention period is required or permitted by law' was replaced with affirmative language about satisfying 'business requirements,' potentially extending retention justifications.